An automated signature generation approach for polymorphic worms using principal component analysis

Author(s)
Author(s)
Mohammed, M. M. Z. E.
Ventura, N.
Hashim, M.
Bashier, E.
Date Issued
2011
Publisher
Infonomics Society
Journal
International Journal for Information Security Research
Volume
1
Issue
2
Start page
45
End page
52
Abstract
Internet Worms pose a major threat to Internet infrastructure security. Security experts manually generate the IDS signatures by studying the network traces after a new worm has been released, a rather costly, laborious, and time consuming task. In this paper we propose automated signature generation system for polymorphic worms. We apply Principal Component Analysis (PCA) to determine the most significant substrings that are shared between polymorphic worm instances and use them as signatures. The experimental results show that the PCA has successfully detected polymorphic worms with zero false positives and low false negatives.
URI
DOI
SFU Affiliated Publication
No
Availability at SFU Library

No database links found.